mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
68d5c9b8f4
The two scheduled jobs write disjoint paths but pin their checkout when they are queued, so a commit landing in between throws away a completed run. Rebase onto the current main and retry instead, deepening the clone only on the rare occasion it is needed.
59 lines
1.4 KiB
YAML
59 lines
1.4 KiB
YAML
name: Sync CVE PoCs
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "15 2 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: repository-updates
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
sync:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.13'
|
|
|
|
- name: Discover and ingest CVE PoCs
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: python3 scripts/update_cves.py --lookback-days 3 --years 2
|
|
|
|
- name: Check for changes and commit
|
|
run: |
|
|
git config user.name 'CVE-BOT'
|
|
git config user.email '[email protected]'
|
|
|
|
git add --all -- \
|
|
.github/cve_sync_state.json \
|
|
github.txt \
|
|
references.txt \
|
|
':(top,glob)[12][0-9][0-9][0-9]/CVE-*.md'
|
|
|
|
if git diff --cached --quiet; then
|
|
echo "No changes to commit"
|
|
exit 0
|
|
fi
|
|
|
|
git commit -m "Update CVE PoCs $(date -u +'%Y-%m-%d')"
|
|
|
|
for attempt in 1 2 3; do
|
|
if git push origin HEAD:main; then
|
|
exit 0
|
|
fi
|
|
echo "Push rejected; replaying onto the current main (attempt $attempt)"
|
|
git fetch --unshallow origin main 2>/dev/null || git fetch origin main
|
|
git rebase FETCH_HEAD
|
|
done
|
|
exit 1
|